lkml.org 
[lkml]   [2022]   [Aug]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: [PATCH v4 2/5] userfaultfd: add /dev/userfaultfd for fine grained access control
Date
On Jul 19, 2022, at 12:56 PM, Axel Rasmussen <axelrasmussen@google.com> wrote:

>
> +static int new_userfaultfd(bool is_syscall, int flags)
> {
> struct userfaultfd_ctx *ctx;
> int fd;
>
> - if (!sysctl_unprivileged_userfaultfd &&
> - (flags & UFFD_USER_MODE_ONLY) == 0 &&
> - !capable(CAP_SYS_PTRACE)) {
> - printk_once(KERN_WARNING "uffd: Set unprivileged_userfaultfd "
> - "sysctl knob to 1 if kernel faults must be handled "
> - "without obtaining CAP_SYS_PTRACE capability\n");
> + if (is_syscall && !userfaultfd_syscall_allowed(flags))
> return -EPERM;
> - }
>
> BUG_ON(!current->mm);
>
> @@ -2098,8 +2105,42 @@ SYSCALL_DEFINE1(userfaultfd, int, flags)
> return fd;
> }
>
> +SYSCALL_DEFINE1(userfaultfd, int, flags)
> +{
> + return new_userfaultfd(true, flags);
> +}

Not critical, but why not to put the userfaultfd_syscall_allowed() check
here? You would be able to lose the “is_syscall”.

I also had a small comment for patch 5.

But these are minor issues, so for the series:

Acked-by: Nadav Amit <namit@vmware.com>


[ Sorry again for misunderstanding the scheme you were using is similar to
KVM and therefore reasonable. ]

\
 
 \ /
  Last update: 2022-08-02 20:47    [W:0.170 / U:0.128 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site